| Message ID | aDbFFkX09K7FrL9h@stanley.mountain |
|---|---|
| State | New |
| Headers | show |
| Series | [v2,next] wifi: rtw89: mcc: prevent shift wrapping in rtw89_core_mlsr_switch() | expand |
Dan Carpenter <dan.carpenter@linaro.org> wrote: > > The "link_id" value comes from the user via debugfs. If it's larger than BITS_PER_LONG then > that would result in shift wrapping and potentially an out of bounds access later. In fact, we > can limit it to IEEE80211_MLD_MAX_NUM_LINKS (15). > > Fortunately, only root can write to debugfs files so the security impact is minimal. > > Fixes: 9dd85e739ce0 ("wifi: rtw89: debug: add mlo_mode dbgfs") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > --- > Use IEEE80211_MLD_MAX_NUM_LINKS as a limit instead of BITS_PER_LONG. > It's stricter and also more informative. > > drivers/net/wireless/realtek/rtw89/core.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/realtek/rtw89/core.c > b/drivers/net/wireless/realtek/rtw89/core.c > index 49447668cbf3..3604a8e15df0 100644 > --- a/drivers/net/wireless/realtek/rtw89/core.c > +++ b/drivers/net/wireless/realtek/rtw89/core.c > @@ -5239,7 +5239,8 @@ int rtw89_core_mlsr_switch(struct rtw89_dev *rtwdev, struct > rtw89_vif *rtwvif, > if (unlikely(!ieee80211_vif_is_mld(vif))) > return -EOPNOTSUPP; > > - if (unlikely(!(usable_links & BIT(link_id)))) { > + if (unlikely(link_id >= IEEE80211_MLD_MAX_NUM_LINKS || > + !(usable_links & BIT(link_id)))) { > rtw89_warn(rtwdev, "%s: link id %u is not usable\n", __func__, > link_id); > return -ENOLINK; > -- > 2.47.2 It looks good to me. Thank you.
Zong-Zhe Yang <kevin_yang@realtek.com> wrote: > Dan Carpenter <dan.carpenter@linaro.org> wrote: > > > > The "link_id" value comes from the user via debugfs. If it's larger than BITS_PER_LONG then > > that would result in shift wrapping and potentially an out of bounds access later. In fact, we > > can limit it to IEEE80211_MLD_MAX_NUM_LINKS (15). > > > > Fortunately, only root can write to debugfs files so the security impact is minimal. > > > > Fixes: 9dd85e739ce0 ("wifi: rtw89: debug: add mlo_mode dbgfs") > > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > > --- > > Use IEEE80211_MLD_MAX_NUM_LINKS as a limit instead of BITS_PER_LONG. > > It's stricter and also more informative. > > > > drivers/net/wireless/realtek/rtw89/core.c | 3 ++- > > 1 file changed, 2 insertions(+), 1 deletion(-) > > > > diff --git a/drivers/net/wireless/realtek/rtw89/core.c > > b/drivers/net/wireless/realtek/rtw89/core.c > > index 49447668cbf3..3604a8e15df0 100644 > > --- a/drivers/net/wireless/realtek/rtw89/core.c > > +++ b/drivers/net/wireless/realtek/rtw89/core.c > > @@ -5239,7 +5239,8 @@ int rtw89_core_mlsr_switch(struct rtw89_dev *rtwdev, struct > > rtw89_vif *rtwvif, > > if (unlikely(!ieee80211_vif_is_mld(vif))) > > return -EOPNOTSUPP; > > > > - if (unlikely(!(usable_links & BIT(link_id)))) { > > + if (unlikely(link_id >= IEEE80211_MLD_MAX_NUM_LINKS || > > + !(usable_links & BIT(link_id)))) { > > rtw89_warn(rtwdev, "%s: link id %u is not usable\n", __func__, > > link_id); > > return -ENOLINK; > > -- > > 2.47.2 > > It looks good to me. > Thank you. I will add a tag during committing. Reviewed-by: Zong-Zhe Yang <kevin_yang@realtek.com>
diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c index 49447668cbf3..3604a8e15df0 100644 --- a/drivers/net/wireless/realtek/rtw89/core.c +++ b/drivers/net/wireless/realtek/rtw89/core.c @@ -5239,7 +5239,8 @@ int rtw89_core_mlsr_switch(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif, if (unlikely(!ieee80211_vif_is_mld(vif))) return -EOPNOTSUPP; - if (unlikely(!(usable_links & BIT(link_id)))) { + if (unlikely(link_id >= IEEE80211_MLD_MAX_NUM_LINKS || + !(usable_links & BIT(link_id)))) { rtw89_warn(rtwdev, "%s: link id %u is not usable\n", __func__, link_id); return -ENOLINK;
The "link_id" value comes from the user via debugfs. If it's larger than BITS_PER_LONG then that would result in shift wrapping and potentially an out of bounds access later. In fact, we can limit it to IEEE80211_MLD_MAX_NUM_LINKS (15). Fortunately, only root can write to debugfs files so the security impact is minimal. Fixes: 9dd85e739ce0 ("wifi: rtw89: debug: add mlo_mode dbgfs") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- Use IEEE80211_MLD_MAX_NUM_LINKS as a limit instead of BITS_PER_LONG. It's stricter and also more informative. drivers/net/wireless/realtek/rtw89/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)